Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kensaurus/cursor-kenji/audit-cicdnpx skills add kensaurus/cursor-kenji --skill audit-cicdgit clone --depth 1 https://github.com/kensaurus/cursor-kenjiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kensaurus/cursor-kenji/audit-cicd)<a href="https://agentmods.dev/skills/kensaurus/cursor-kenji/audit-cicd"><img src="https://agentmods.dev/badge/skills/kensaurus/cursor-kenji/audit-cicd.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.02537 |
| Opus 5 | $0.00036 | $0.01269 |
| Sonnet 5 | $0.00014 | $0.00507 |
| Haiku 4.5 | $0.00007 | $0.00254 |
Grade A, and why
audit-cicd scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CI/CD Audit Skill
Degree of freedom: MIXED — Steps 1–3 judgment [HIGH freedom]; Step 0
gh inventory and Step 4 deletes [LOW freedom — run exactly].
Systematic audit of GitHub Actions workflows to cut the Actions bill (minutes +
storage) and speed up CI without losing test coverage or deploy safety.
Uses the gh CLI for live billing, run history, and storage data.
How to reason
- Observe — quote the trigger,
runs-on,concurrency, orghminute/storage number - Interpret — billed twice, doomed minutes, or a 10× runner on every push?
- Classify — double-bill / no-concurrency / expensive-runner / doomed-job / storage / correct
- Severity — by
$× safety; never score a cut that drops coverage
Worked example
Observe:
build-mobile.ymlruns-on: macos-15onpush:to every branch; noif:gate; private repo. Interpret: every push bills ~10× Ubuntu for an iOS job nobody requested. Classify: expensive-runner on ordinary push. Severity: Very high (~10×). Finding:build-mobile.yml| macos on push | dispatch/tag-only | ~10×
Step 0: Inventory the account and pipelines [LOW freedom — run exactly]
Measure before optimizing. Only private repos consume the paid minute allowance; public repos get free minutes — don't spend effort there.
# Which repos actually cost money (private, active, recent pushes)?
gh repo list <owner> --limit 200 --json name,visibility,isArchived,pushedAt \
--jq 'sort_by(.pushedAt)|reverse|.[]|select(.visibility=="PRIVATE" and .isArchived==false)|"\(.name)\t\(.pushedAt[0:10])"'
# Per repo: active workflows, run volume (last 14d), and runner types
gh api "repos/<owner>/<repo>/actions/workflows" --jq '.workflows[]|select(.state=="active")|.name'
gh run list --repo <owner>/<repo> --created ">=YYYY-MM-DD" --limit 200 --json databaseId --jq 'length'
# Storage (the other half of the bill)
gh api "repos/<owner>/<repo>/actions/artifacts" --paginate --jq '[.artifacts[]|select(.expired==false)|.size_in_bytes]|add'
gh api "repos/<owner>/<repo>/actions/cache/usage" --jq '.active_caches_size_in_bytes'
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 214 lines · 72 tokens per session scan A 4184cb35e132
audit-cicd is a skill published in the GitHub repository kensaurus/cursor-kenji (9 stars, last pushed 8d ago), licensed MIT. It adds 72 tokens to every session and 2,537 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
513-frameworks-micronaut-db-migrations-flyway
Use when you need to add or review Flyway database migrations in a Micronaut application — micronaut-flyway, db/migration scripts, flyway.datasources. configuration, and alignment with JDBC or Micronaut Data. This should trigger for requests such as Add or review Flyway migrations in a Micronaut project; Configure…
devlab-cicd-onboard
Provider-neutral CI/CD onboarding workflow for repository analysis, pipeline design, configuration boundaries, and release verification.
infra-jenkins-pipeline-ops
Operate Jenkins jobs, credentials, plugins and shared libraries through a portable, configuration-driven workflow.
infra-woodpecker-pipeline-ops
Design, inspect and operate portable Woodpecker CI pipelines with explicit repository and deployment boundaries.
ci-cd
Workflow for creating a complete CI/CD pipeline. Use when the user needs to set up or modify CI/CD pipelines.
base-cn-registry-mirror-strategy
国内镜像源与代理分层策略（Docker / Debian / Alpine / Node / Python / Maven / Gradle / Go），用于 Dockerfile 与 CI 的可维护加速。.